Vendor / invoice fraud (bank detail change)：手法、警示信号与应对

Business fraud · alto

The criminal hacks a supplier's email (or the customer's) or registers a look-alike domain. They then announce the company "has changed banks", sometimes with a letterhead letter and a new account, or resend a genuine invoice with altered details.

In Brazil, a common variant is the tampered boleto: the PDF looks the same but the barcode line and payee have been changed. In the US and Europe, the change is usually to the account and routing numbers for ACH or wire payments.

Because amounts and dates match the history, the payment goes through the normal process. It is one of the most common forms of BEC.

Sinais / Signs

Bank-change notice by email, especially near a due date
New account in another country, bank or under a different legal name
Boleto whose payee is not the supplier
Pressure to pay quickly to avoid penalties or cutoff
Small differences in domain, signature or contact phone

Prevenção / Prevention

Never change bank details based on email alone; confirm using a phone number already on file
Separate who maintains vendor records from who approves payments
Check the payee name and tax ID before paying
Use bank account validation services where available
Make a small test payment after any change and confirm with the supplier

O que fazer / What to do

Contact your bank immediately to try to freeze the funds
Tell the real supplier: their email may be compromised
Report to IC3 (US) or file a police report (Brazil)
Keep the invoice, the email with headers and receipts

FAQ

Who bears the loss, the customer or the supplier?

It depends on the contract and where the security failure happened. Disputes are common, so contracts should address bank-detail changes.

Can a boleto PDF be altered without me noticing?

Yes. Always check the payee shown in your banking app before confirming.

FBI IC3 - Internet Crime Complaint Center · FTC - ReportFraud · CERT.br · Consumidor.gov.br